CVE-2021-37136
Summary
| CVE | CVE-2021-37136 |
|---|---|
| State | PUBLISHED |
| Assigner | JFROG |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-10-19 15:15:07 UTC |
| Updated | 2026-10-08 22:17:10 UTC |
| Description | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.059080000 probability, percentile 0.930650000 (date 2026-10-11)
Problem Types: CWE-400 | CWE-400 CWE-400
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Application | Netapp | Oncommand Insight | - | All | All | All |
| Application | Netty | Netty | All | All | All | All |
| Application | Oracle | Banking Apis | 19.1 | All | All | All |
| Application | Oracle | Banking Apis | 19.2 | All | All | All |
| Application | Oracle | Banking Apis | 20.1 | All | All | All |
| Application | Oracle | Banking Apis | 21.1 | All | All | All |
| Application | Oracle | Banking Apis | All | All | All | All |
| Application | Oracle | Banking Digital Experience | 18.1 | All | All | All |
| Application | Oracle | Banking Digital Experience | 18.2 | All | All | All |
| Application | Oracle | Banking Digital Experience | 18.3 | All | All | All |
| Application | Oracle | Banking Digital Experience | 19.1 | All | All | All |
| Application | Oracle | Banking Digital Experience | 19.2 | All | All | All |
| Application | Oracle | Banking Digital Experience | 20.1 | All | All | All |
| Application | Oracle | Banking Digital Experience | 21.1 | All | All | All |
| Application | Oracle | Coherence | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Coherence | 14.1.1.0.0 | All | All | All |
| Application | Oracle | Commerce Guided Search | 11.3.2 | All | All | All |
| Application | Oracle | Communications Brm - Elastic Charging Engine | All | All | All | All |
| Application | Oracle | Communications Brm - Elastic Charging Engine | 12 | 0.0.5.0 | All | All |
| Application | Oracle | Communications Cloud Native Core Binding Support Function | 1.10.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Binding Support Function | 1.11.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Network Slice Selection Function | 1.8.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Policy | 1.15.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Security Edge Protection Proxy | 1.7.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Unified Data Repository | 1.15.0 | All | All | All |
| Application | Oracle | Communications Diameter Signaling Router | All | All | All | All |
| Application | Oracle | Communications Instant Messaging Server | 8.1 | All | All | All |
| Application | Oracle | Helidon | 1.4.10 | All | All | All |
| Application | Oracle | Helidon | 2.4.0 | All | All | All |
| Application | Oracle | Peoplesoft Enterprise Peopletools | 8.48 | All | All | All |
| Application | Oracle | Peoplesoft Enterprise Peopletools | 8.57 | All | All | All |
| Application | Oracle | Peoplesoft Enterprise Peopletools | 8.58 | All | All | All |
| Application | Oracle | Peoplesoft Enterprise Peopletools | 8.59 | All | All | All |
| Application | Oracle | Webcenter Portal | 12.2.1.3.0 | All | All | All |
| Application | Oracle | Webcenter Portal | 12.2.1.4.0 | All | All | All |
| Application | Quarkus | Quarkus | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Netty Project | Netty | affected unspecified 4.1.68Final custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede94... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Oracle Critical Patch Update Advisory - April 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc080... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| [SECURITY] [DLA 3268-1] netty security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-5316-1 netty | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| Bzip2Decoder doesn't allow setting size restrictions for decompressed data · Advisory · netty/netty · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| February 2022 Apache Netty Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181469 Debian Security Update for netty (DLA 3268-1)
- 181471 Debian Security Update for netty (DSA 5316-1)
- 182068 Debian Security Update for netty (CVE-2021-37136)
- 199574 Ubuntu Security Notification for Netty Vulnerabilities (USN-6049-1)
- 240458 Red Hat Update for JBoss Enterprise Application Platform 7.4.5 on RHEL 7 (RHSA-2022:4918)
- 240459 Red Hat Update for JBoss Enterprise Application Platform 7.4.5 on RHEL 8 (RHSA-2022:4919)
- 240925 Red Hat Update for Satellite 6.12 (RHSA-2022:8506)
- 376257 Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUJAN2022)
- 960485 Rocky Linux Security Update for Satellite (RLSA-2022:8506)
- 980258 Java (maven) Security Update for io.netty:netty-codec (GHSA-grg4-wf29-r9vv)